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A METHOD FOR ACCELERATING CRYPTOGRAPfflC OPERATIONS 

ON ELLIPTIC CURVES 
This invention relates to a method for performing cpmputations in cryptographic 
systems utilizing elliptic curves. 

5 

BACKGROUND OF THE INVENTION 

A public-key data communication system may be used to transfer information 
between a pair of correspondents. At least part of the infomiation exchanged is enciphered 
by a predetermined mathematical operation by the sender and the recipient may perform a 

10 complementary mathematical operation to decipher the information. 

Each correspondent has a private key and a public key that is mathematically related 
to the private key. The relationship is such that it is not feasible to determine the private key 
from knowledge of the public key. The keys are used in the transfer of data, either to encrypt 
data that is to be transferred or to attach a signature to allow verification of the authenticity of 

IS the data. 

For encryption, one correspondent uses the public key of the recipient to encrypt the 
message and sends it to the recipient The recipient then uses her private key to decipher the 
message. 

A common key may also be generated by combining one parties public key with the 
20 other parties private key. It is usual in such cases to generate new private and conrcsponding 
public keys for each communication session, usually referred to as session keys or ephemeral 
keys, to avoid the long-term keys of the parries being compromised. 

The exchange of messages and generation of the public keys may therefore involve 
significant computation involving exponentiation when the cryptographic system utilizes in 
25 Z*p. the finite field of integers mod p where p is a prime or the analogous operation of point 
multiplication when the system utilizes an elliptic curve, hi an elliptic curve system, an 
ephemeral key pair is obtained by generating a secret integer, k and performing a point 
multiplication in the seed point Q to provide the ephemeral public key kQ. Similariy, the 
generation of a common ephemeral session key will require multiplication of a public key 
30 kaQ. which is a point on the curve, with a secret integer kb of the other correspondent so that 
point multiplication is again required. 
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A similar procedure is used to sign a message.except that the sender applies his 
private key to the message. This permits any recipient to recover and verify the message 
using the senders public key. 

Various protocols exist for implementing such a scheme and some have been widely 
5 used. In each case, however, the sender is required to perform a computation to sign the 
information to be transferred and the receiver is required to perform a computation to verify 
the signed information. 

In a typical implementation a signature component s has the form:- 

s = ae + k (modn) 
1 0 where; in an elliptic curve crypto system, 

P is a point on the underlying curve which is a predefined parameter of the system; 

k is a random integer selected as a short temi private or session key; 

R = kP is the corresponding short term public key; 

a is the long term private key of the sender; 
15 Q = aP is the senders corresponding public key; 

e is a secure hash, such as the SHA-1 hash function, of a message m and the short 

term public key R; and 

n is the order of the curve. 

The sender sends to the recipient a message including m, s, and R and the signature is 
20 verified by computing the value R^ = (sP-eQ) which should correspond to R. If the 
computed values correspond then the signature is verified. 

In order to perform the verification it is necessary to compute the point 
multiplications to obtain sP and eQ, each of which is computationally complex. Where the 
recipient has adequate computing, power this does not present a particular problem but where 
25 the recipient has limited computing power, such as in a secure token or a "Smart card " 
^plication, the computations may introduce delays in the verification process. 

Key generation and signature protocols may therefore be computationally 
intensive. As cryptography becomes more widely used there is an increasing demand to 
implement cryptographic systems that are faster and that use limited computing power, such 
30 as may be found on a smart card or wireless device. 

Elliptic curve cryptography (ECC) provides a solution to the computation issue. ECC 
permits reductions in key and certificate size that translates to smaller memory requirements, 
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and significant cost savings. ECC can not only significantly reduce the cost, but also 
accelerate the deployment of smart cards in next-generation applications. Additionally, 
although the ECC algorithm allows for a reduction in key size, the same level of security as 
other algorithms with larger keys is maintained. 
5 However, there is still a need to perform faster calculations on the keys so as to speed 

up the information transfer while maintaining a low cost of production of cryptographic 
devices. 

Computing multiples of a point on an elliptic curve is one of the most frequent 
computations performed in elliptic curve cryptography. One method of speeding up such 
1 0 computations is to use tables of precomputed multiples of a point. This technique is more 
useful when a point is known beforehand. However, there are cases when multiples of 
previously imknown points are required (for example, in ECDS A verification). Thus there is 
a need for a system and method for facilitating point multiplications. 

1 5 SUMMARY OF THE INVENTION 

In general terais, the present invention represents the scalar k as a combination of 
components ki and an integer X derived from an endomonphisim in the underlying curve. 

The method is based on the observation that, given an elliptic curve (EC) having 
complex multiplication mapping over a finite field, there is an X, which is the solution to a 
20 quadratic, for which the complex multiplication mapping is equivalent to multiplying a point 
Q by X, It will often be less computationally expensive to compute XQ via the complex 
multiplication map, compared to treating ?v as a integer and performing the EC multiplication. 
In practice, point multiplication by other scalars (not just X) is required. It is also shown how 
the multiplication mapping may be used to compute other multiples of the point. 
25 In accordance with this invention there is provided a method for accelerating 

multiplication of an elliptic curve point Q(x,y) by a scalar k, the method comprising the steps 
of: 

selecting an elliptic curve over a finite field F such that there exists an endomorphism \}/, 
where h;(Q) = X*Q for all points Q(x,y) on the elliptic curve; and 
30 using smaller representation k\ of the scalar k in combination with the mapping y to compute 
the scalar multiple of the elliptic curve point Q. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

These and other features of the preferred embodiments of the invention will become 
more apparent in the following detailed description in which reference is made to the 
appended drawings wherein: 
5 Figure 1 is a schematic diagram of a communication system; 

Figure 2 is a flow chart showing the steps of implementing a first embodiment of the 
present invention. 

Figure 3 is a flow chart showing the steps of providing parameters required to 
implement the method of Figure 2. 

10 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 

For convenience in the following description, like numerals refer to like structures in 
the drawings. Referring to Figure 1 , a data communication system 10 includes a pair of 
correspondents, designated as a sender 12, and a recipient 14, connected by a communication 

15 channel 16. Each of the correspondents 12,14 includes a cryptographic processor 18,20 

respectively that may process digital information and prepare it for transmission through the 
channel 16 as will be described below. Each of the correspondents 12,14 also includes a 
computational unit 19,21 respectively to perform mathematical computations related to the 
cryptographic processors 18,20. The processors 18, 20 may be embodied in an integrated 

20 circuit incorporated in the processor or may be implemented as instructions encoded on a data 
carrier to implement a predetermined protocol in conjunction with a general purpose 
processor. For the purpose of illustration it will be assumed that the correspondent 12 is in 
the form of a smart card having a dedicated processor 1 8 with relatively limited computing 
power. The processor 20 may be a central server communicating with the card by channel 16 

25 and channel 16 may be a wireless communication channel if preferred. 

' The cryptographic processors 1 8 implement an elliptic curve cryptographic system, of 
ECC, and one of the functions of the cryptographic processor 18 is to perform point 
multiplications of the form k-Q, where k is an integer and Q a point on the underlying elliptic 
curve, so that they may be used as a key pair k, kQ in a cryptographic scheme. As noted 

30 above, cryptographic computations such as the multiplication of an elliptic curve point by a 
scalar value are computationally expensive. 
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A method for accelerating scalar multiplication of an elliptic curve point Q(x,y) is 
shown in figure 2 and indicated generally by the numeral 50. The subject algorithm increases 
the speed at which the processors 12 can for example sign and verify messages for specific 
classes of elliptic curves. The method is based on the observation that given the general 
5 equation for an elliptic curve E: 

y^ + aixy + asy = x^ + a2X^ + a4X + a^ (1) 
over a finite field, exemplified as Fq (q is a prime power) and when there exists an 
endomorphism where ij/(Q) == X'Q for all points Q(x,y) on the elliptic curve, then 
multiplication of the point Q by an integer k may be accelerated by utilizing combinations of 
1 0 smaller representations kj of k in combination with the mapping v|/. The mapping vj/ also 
allows precomputation of group elements and combinations thereof, which may be used in 
subsequent calculation of kQ. 

Referring now to figure 2, a flow chart of a general embodiment for accelerating point 
multiplication on an elliptic curve, is shown by numeral 50. The system parameters are first 
15 selected. As an initial step an underlying elliptic curve E is selected to have certain 

characteristics. In a first embodiment of the invention the generalized elliptic curve (1) may 
be expressed in the following form: 

E: y^ = x^ + b mod p; where p is a prime, (2) 
Firstly, the modulus p can be determined such that there is a number, y where 7 e Fp 
20 (Fp is the field of size p consisting of all integers mod p), and = 1 mod p (a cube root of 
unity). If for example p = 7, then y = 2, since 2^ mod 7 =L Such a y does not necessarily 
exist for all p, and therefore this must be taken into consideration when choosing the value of 
p. Typically, the chosen p should be at least 160 bits in length for adequate cryptographic 
strength. 

25 After the curve E has been selected, a mapping fimction v}/ is determined. The 

mapping fimction \|/: (x, y) (yx, y), simply maps one set of points on the curve to another 
set of points on the curve. There exists an integer X such that v(Q) = ^'Q for all points 
Q(x,y) of interest on the elliptic curve, E. This integer X may be found by noting that X^ ^\ 
mod n, where n is the number of points on the elliptic curve E over Fp i.e. the number of 

30 points on E(Fp). There may exist more than one solution for XinX^ =1 mod n, but only one 
of those solutions will satisfy the mapping fimction \|;. It is important to note that since y^ 

5 

^^^'^^^^mmm^mmmmmammmmmFmiiii JJMJiiiiiiiiiiiiiiiiiM llllllLlllliJJJllllliBMMM 



wo 00/39668 PCT/C A99/01 222 



mod p = I, both Q and \|/{Q) satisfy the equation for E. Therefore, instead of having to 
perform lengthy calculations to determine the results of multiplication by X, it can be done 
very efficiently using the results of the mapping function so that multiplication by X can be 
done very efficiently. 

5 A seed point Q is selected and the system parameters E, p, Q, A., \j/(Q), and y are 

stored in the card 12, as indicated at 52, at manufacture time for use by the cryptographic 
processor 18. To implement a cryptographic procedure such as encryption, key agreement or 
signature it is necessary to select an integer k for use as an ephemeral private key k and 
generate a corresponding public key kQ. 
1 0 The value of k may be expressed as: - 

k = (ko + kiX)modn (3) 
where n is the number of points on E(Fp) and ko and ki are integers. The point k"Q 
then becomes: 

k'Q = (koQ + ki?uQ) mod n (4) 
15 For some cryptographic operations the value of k may be chosen at random and in 

these cases, rather than select k it is possible to select values for ko and ki at random, having a 
length of [log2 (n)]/2 not including sign bits, (i.e. the length of the kfs are chosen to be at 
least one half the length k) and then calculate the value for k using equation (3). 
Having selected the values of ko, k\ as indicated a 54 in figure 2, the right side of equation (4) 
20 can be calculated quickly using an algorithm analogous to the ''Simultaneous Multiple 
Exponentiation" as described in the "Handbook of Applied Cryptography" (HAC) by 
Menezes et. aI.(Algorithm 14.88) and indicated at 56. For convenience the algorithm is 
reproduced below. It may be noted that in an additive group exponentiation is analogous to 
addition, thus replacing the multiplication in the algorithm with addition, yields the 
25 following: 

Algorithm 1 Simultaneous Multiple Addition 

INPUT: group elements go, gi, g/-i and non negative t-bit integers e©, ei, Cm- 
30 OUTPUT: goeo + giCj + ... + g^e/.i. 

stepl . Precomputation, For / fi*om 0 to (2^ - 1): 
where i = (i/.i ... io)2 
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stq52. A 0 

step3. For i from 1 to / do the following: 

step4. Return (A) where A = goeo + giCi + . . . + g/.ie/.i 



10 



Applying this algorithm to equation (4) it can be seen that there are two group 
elements, go, gi namely Q and XQ, so that / = 2 and two integers eo, ei namely ko,ki. The 
algorithm pemiits precomputation of some of the values and initially G\ is precomputed. The 
results of precomputation of Gi with / = 2 is shown in table 1. 
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After performing a point addition to construct the point: Q + vt/(Q). It is possible to fill 
15 in table 1 with the computed elements to yield table 2. These elements may be pre-computed 
and stored in memory as shown at step 58 in figure 2. 
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20 Before step of the algorithm can be performed, has to be determined and accordingly Ii 
through It have to be found as indicated at 60. A notional matrix or combing table may be 
constructed using the binary representation of ki. If, for example, ko = 30 and ki = 10, then t 
has the value five since the maximum number of bits in the binary representation of ko 
through k| is five and the notional matrix constructed from their binary representation is 

25 shown in Table 3. I,- is determined by the number represented in the colunrn where the first 
row contains the least significant bit, the second row contains the next significant bit, etc. 
Therefore it can be seen from table 3 that Ii = I2 = (1 1) = 3, 13 = (01) =1 , 14 =3, and I5 = 0. 
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Table 3 



All the components needed to complete the algorithm are available and the iteration of 
step three is performed as shown at 62. 
Initially A O and i is set to 1 . 

li = Ii which from table 3 is equal to 1 . Gj^ is therefore G] which from table 2 is Q, 

The value of A from the iteration for I = 1 is therefore O + Q = Q. 

For the next iteration where i = 2 the initial value of A is Q so A <— Q+Q = 2Q 
Ii = I2 = 3 from table 3. Gj^ therefore equates to G3 from table 2 which is Q+\(/(Q). 

A + Gj therefore is computed as 2Q+Q-hv|/Q = 3Q+H/Q. 

The iterations continue for each value of i set out in table 4 until after the 5'^ iteration 
the value for koq = k, A,Q, i.e. kQ is computed. 
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30Q+ 10vi/(Q) 



Table 4 



Each iteration requires a point doubling (A+A) and a point addition (A+Gj^ ) although 

in some cases the value of Gj may be O that will reduce the computation. 

Thus it may be seen that this method will require a number of point doubles equal to 
max {log2(ki)} , and almost as many point additions. The nimiber of point additions can be 
reduced using windowing (Alg. 14.85 HAC) and exponent receding techniques. Since the 
value of i and Gi can be precomputed, the point additions are easily performed by retrieving 
the appropriate precomputed element G, from table 2. Once kP has been computed, it may be 
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used as the correspondents 12 ephemeral public key in encrypting or signing transmissions 

over the channel 16. 

To summarize, for cryptographic operations like encryption and Diffie-Hellman, 
signature, an integer k is required with a corresponding public key kQ, computed. The values 
5 ko and kt are chosen at random, each having a length one half the length of n and the term 
koQ = kiXQ generated using a suitable algorithm. When the k's are chosen in this way, the 
method seems to be as secure as the random generation of k itself. Of course it is possible to 
choose the ki's to have fewer bits in order to improve efficiency. 

In the above technique, the method of writing k=ko+kiA, in conjunction with 
1 0 simultaneous combing achieves a speed up of the simultaneous multiple addition algorithm. 
The technique of writing k=ko-f-kiX may also be used with the scalar multiplication techniques 
to advantage, namely with winding, combing ,etc. 

For some mappings \{/, it is also possible to use more than two sub k's. It is possible 
for some \}/'s to write k=ko+kiX+k2X^ allowing the value of k to be computed by applying the 
15 simultaneous multiple addition algorithm. 

In a second embodiment of the invention a different form of the generalized elliptic 
curve equation (1) is used, namely: 

y^ = (x^ - ax) mod p (5) 
Once again, p will be a prime number having at least 160 bits. For this type of curve, the 
20 properties required for y are different. It is now required to find a value such that 

= -1 mod p. A change in the property of y requires a different mapping function \\f' to be 
used. In this embodiment the mapping takes the form v}/*: (x, y) -> (-x, yy). If (x,y) is on the 
curve, then v|/'(x,y) is also on the curve. In this case X"^ ^ 1 mod n (n is still the number of 
points on E(Fp)), and therefore X, can be calculated. The mapping \|;'(Q) = >^'Q is performed as 
25 before and once again multiplication by X can be done very efficiently for this curve. The 
equation for k in this embodiment is the same as in the first embodiment and is represented 
by: 

k = (ko + ki^) mod n (6) 
This equation is the same as in the previous embodiment, having only two group elements. 
30 Thus using the group elements Q and Q+ \j;'(Q) in the algorithm 1, the point k'Q may be 

calculated. This computation will require a number of point doubles equal to max {log2(kj)}. 
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and a similar number of point additions. As described earlier the number of point additions 
can be reduced using windowing and exponent receding techniques. 

This method applies to other elliptic curves, so long as there exists an efficiently 
computable endomorphism, ij/. 
5 The above embodiments assume that k can be chosen at random and therefore k© and 

ki can be selected instead and determine k. For cryptographic protocols, where it is not 
possible to choose k, it is first necessary to find ko, kj of the desired "short" form from the 
given value of k such that k = (ko + kiX.) mod n. In some cases, more than two k's can be 
used to advantage. 

10 As may be seen in the embodiments described above when a point is known 

beforehand, tables can be built to speed multiplication. However, there are cases when 
multiples of previously unknown points are required {for example, this can occur in ECDSA 
verification) and it is then necessary to take the value of k as provided and then determine 
suitable representations for kj. 

15 Thus in a third embodiment, system parameters and a value k is provided, the point Q, 

the required multiple k, and the complex multiplication multiple k are known. It is necessary 
to determine the "short" ki*s from the value for k, which is predetermined. A method for 
doing this described as follows and illustrated in the flow chart of figure 3. As a pr'e- 
computation (not requiring k) we compute two relations: 

20 ao boX = 0 mod n 

3] 4- bi>wsOmodn 

such that ai and bj are numbers smaller than n. It is preferable that aj and bj are as small as 
possible, however, the present method has advantages even when ai and bi are not minimal. 
The pair, a,- and bj, where aj and bi are both small, can be viewed as a vector, uj with a small 
25 Euclidean length. Typically the method described below produces ko and ki having 
representations one half the size of the original k. 

In the present embodiment, kQ can be computed efficiently by utilizing precomputed, 
short vector representations to obtain an expression of the form: 

koQ + JtkiQ 

30 This is accomplished by using precomputed vectors to derive fractions fo and /j that do 

not require knowledge of k. A vector z is generated from the combination of fractions fo and 
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yi and k. The vector z is used to calculate a second vector v' where v'= (vo ,vi ) and the value 
of kQ calculated as 

vo^Q + A.vi^Q (8) 
The method of achieving this solution is described below in greater detail 
5 To produce small a, and bi, it is possible to make use of the - lattice basis reduction 

algorithm (HAC p.l 18), which would directly result in short basis vectors. However, in this 
preferred embodiment the simple extended Euclidean algorithm is employed on the pair (n, 
Xy The extended Euclidean algorithm on (n, X) produces linear combinations cm + d,X = 
where the representation of Vi (e.g, bit-length) decreases and the representation of Cj and di 
10 increases with i. 

The two smallest values of |Cd,, r^ )i resulting from using the extended Euclidean 
algorithm are saved. The size of these vectors are measured with the squared Euclidean norm 

J.- )| = d.2 -f. Y,^, The terais in these minimal relations are denoted d^, and d^, f, . And 
will typically occur in the middle of the algorithm. Even if the minimal relations are not 
15 retained, suboptimal relations may still give the method an advantage in the calculation of 
point multiples. 

The values of a^ and hi are constructed by defining ao = - , bo = d^ and ai = - f, , 

bj = do all of which may be precomputed. 

The next task is to find a small representation for the multiple k. 
20 Given the computation of ao,bo and a^^b, it is possible to designate the vectors Uo,ul, 

where Uo = (ao, bo) and ui = (ai, bi). These vectors satisfy ai +bi?L = 0 (mod n). The 

multiplication of the group elements Q by the vector v = (vo, Vi) is defined as (vq + v,A.)Q. 

Since ai +biX = 0 (mod n), UoR = UiR = 0 for any group element R. Hence for any integers Zq 

and Zi, v'R = (v - ZoUo - ZiU|)R for any group element R. 
25 Integers zo and Z\ may be chosen such that the vector v' = v - zqUo - ziUi has 

components that are as small as possible. Again, this method will have an advantage if the 

components of v' are small, but not necessarily minimally so. 

The appropriate zo and z\ are calculated by converting the basis of v into the basis {uo, 

Ui}, The conversion between basis involves matrix multiplication. To convert the vector v = 
30 (vo, vi) fi-om the {uo, Ui} basis to the standard orthonormal basis {(1,0),(0,1)}, 
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To convert in the other direction, from the standard orthonomial basis {(1,0),{0,1)} to the (uo, 
Ui) basis, the multiplication is simply by the inverse of M, 



inverse{M) = v^^x^owx 



1 



a^b^ -a^b^ [-a, ^ 

Since the vector v = (k, 0) has a zero component, the bottom row of inverse(M) is not 
required, and therefore to convert to the {uo, Ui} basis only the fractions 





^0^1 "^A 

are needed. 

The fractions^o and f\ may be precomputed to enough precision so that this operation 
may be effected only with multiplication. It should be noted that the computations leading to 
these fractions do not depend upon k, therefore they can be computed once when the elliptic 

1 5 curve is chosen as a system parameter, and do not need to be recalculated for each k. 
Similarly the vectors v, Uo and Ui may be precomputed and stored. 

Once a value of k is selected or determined the value of kQ may be computed by first 
calculating z = (zo, Zi), where z is defined as (zo, zi) = (round(kfo), round(kfi)). 
Other vectors near to z will also be useful, therefore rounding could be replaced with floor or 

20 ceiling functions or some other approximation. 

Once a suitable z has been determined, an efficient equivalent to v (k,0) is calculated 
by v' == (vo', Vi') = V - zqUo -ziUj. The phrase "efficient equivalent'* implies a vector v' such 
that vT = vP and v' has small coefficients. The value kQ is then calculated as vq'Q + vj'^Q. 
This value can be calculated using simultaneous point addition as described above, with 

25 enhanced efficiency obtained from the use of non-adjacent form (NAF) receding as described 
above and as described in H.A.C. 14.7 at page 627. Thus, even where k is predetermined, 
values of ko and k] can be computed and used with the mapping function to obtain a value of 
kQ and hus he key pair k, kQ. 
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For the case where k is to be separated into 3 portions k = ko + ki?t + k2k^, small 
vectors can be obtained from L"' -row-reducing 
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5 A small vector equivalent (three-dimensional row) can be obtained in a similar way to 

the two-dimensional case. 

Using these methods to determine the value of k"Q greatly reduces the processing 

power required by the cryptographic processors 12. It also increases the speed at which these 

repetitive calculations can be done which, in turn, reduces the time to transfer infomiation. 
52 10 It will be appreciated that once the scalar multiple k has been represented in terms of 

m shortened components k = ko + ki ^ k^k^ -i- . . ,kni-i other options for efficient elliptic 

[|i curve scalar multiplication may be used in place of or in conjunction with the simultaneous 

multiple addition algorithm. These options include windowing (fixed and sliding), combing, 
\2 bit receding and combinations of these techniques. 

nj 15 One particularly beneficial technique permits tables built for one component of the 

multiplication, say ko, to be reused for other components ki etc. This is accomplished by 

\^ transforming the computed table elements by applying the mapping y as required. 

As a further exemplification, an embodiment where k can be recast as k = ko + kiX + 
kaX^, where k has m-bits and kj have roughly m/3 bits is described below. 
20 Once the components kj have been determined, they may be receded from the binary 

representation to the signed binary representation having less non-zero bits. This receding 
can take the Non- Adjacent-Form (NAF), where every 1 or - I bit in the representation if k, is 
non-adjacent to another non-zero in the signed binary string. This receding is described in 
H.A.C. 14.7 p. 627. 

25 Once each k,- has been recoded, a table can be constructed to aid in computing k^^P . 

A NAF windowing table precomputes certain short-bit length multiples of XP . The 
width of the window determines the size of the table. As k,- has been recordedto have no 
adjacent non zeros, odd window widths are suitable. A 3-bit wide NAF window would 
contain 
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1 0- 1 



The receded k\ values are built by concatenating these windows, and padding where 
necessary with zeros (H.A.C., p. 616). 
5 The required number of additions can be reduced with use of this table, since it is 

necessary to add or subtract an EC point only for every window encountered instead of for 
every non zero bit. 

Initially therefore this technique is applied to the computation of koP. 

The table built for the koP calculation can be applied to the k^Jl P calculation if the 
10 table elements are mapped with the \}/ mapping using the operator y . Similarly, ^2^^^ can 
be accelerated by using the table built for koP, but mapping the table elements with y^. 

In applying the sHding window technique to the components, only one set of 
doublings need be performed. 

To illustrate this example of a preferred embodiment the following example will be 

15 used: 

Ifk= [10110101 1I01]2 + [11 1010101 101]2 ?L, 
then recoding 

k = [10-100-10-100-101] + [1000-10-10-10-101] X, 

20 A 3-bit window table on P is precomputed containing l^P, [10-1]*P, [101]«P. This 

requires two EC additions, and two EC doublings. 
After this, kP can be calculated as 

kP = [10-100-10-100-101] P + [1000-10-10-10-101] • X? 
by adding/subtracting elements from the table. 
25 This can be done using an accumulator A as follows: 

A<— 0 ; initialize 

A += \|/ (1 • P) ; consuming the top bit of 

A<~2A ; double A 

A^2A 

30 A <- [1 0 -1] P ; consuming the top 3 bits of 
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A"=[1013vP 
A<-2A 
A . = [101]P 
5 K^tA 

A --[1013\)/P 
A4-2^A 
A - = [10-1]P 

A-f-=-M/P 

10 

In sxunmary, the previously described technique is as follows. Given an elliptic curve 
E and an endomorphism \\f, there corresponds an integer X such that X.Q=\|/(Q) for all points 
QeE. Select an integer m and compute an equivalent number m of "short basis vectors'* bj, 
b2, . . .,bm- Each such basis vector corresponds to an integer, and each such integer is 
1 5 divisible by the number of points n = # E(Fp"^) (i.e. the nimiber of points). Now, given an 

integer k, (0 < k < n), we v^te k-^k.^ Z , where the kj's are chosen to be "short". This is 

done by finding the difference between a certain vector (which represents k) and a nearby 
vector in the lattice generated by bi, b2, . . .,bin. 

The following embodiment explicitly describes an application of the previously 
20 described technique (endomorphism and basis conversion and "Shamir's trick") to elliptic 
curves defined over composite fields. In particular, we describe an application to curves 
E(Fp"^) where p is an odd prime is described. The following embodiments exempliiy 
techniques for such curves. 

This technique is described in the case where the map v is the Frobenius map M/(x,y) 
25 = (x^yP) and W where A3€Fp. 

In this case, it is known that the Frobenius m^ satisfies the \(/^ - ty + p = 0, where t = 
p+l-#B(Fp"0. 

It follows that - tX. H- p = 0 mod n and so X^^^ - 1^.^''* + p>.' = 0 mod n. 
Note that the vectors; 
30 (X"^^.. xKxKx^) 

15 



; consuming a 3 bit window of k[ 
; double A 

; consuming 3 bits of k\ 

; consuming 3 bits of k[ 

; consuming the last of k^ 
; producing kP. 
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(-t, 


p. 
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...,o, 1) 




bm 


(p> 


0, 


OA... 


0, 


1,-t) 



consist of m "short" basis vectors of the vector space Q". It follows that to compute 
k-Q on such a curve we can proceed using the vectors bub2,..bm and the technique described 
1 0 previously. 

In the above embodiments it will be appreciated that k,X.Q can be obtained from 
v|/(kQ) is the mapping is more efficient than addition. 

Although the invention has been described with reference to certain specific 
embodiments, various modifications thereof will be apparent to those skilled in the art 
15 without departing fi-om the spirit and scope of the invention as outlined in the claims 
appended hereto. 
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